The best SMTP for agencies is whichever one gives you real per-client reputation isolation, and only two options actually do: separate sending IPs, or separate provider accounts. Subaccounts on SendGrid and Mailgun split your reporting and API keys, but on a standard plan every client still leaves from the same shared IP pool. At 10 clients sending 100K each, a dedicated server with per-client IPs and subdomains runs a flat $549 one-time against roughly $990/month on Mailgun Scale. Here is how the six realistic options score on the six things agencies actually care about.
What agencies need that solo senders do not
A solo sender has one reputation to protect. An agency has N reputations, and unless you isolate them, they are correlated. That single sentence is the whole problem.
Six axes matter, and provider marketing pages cover almost none of them:
- Client isolation. Can client A's complaint rate touch client B's inbox placement?
- White-label. Does the client see your brand and their own sending domain, or a vendor's?
- Per-client reporting. Can you hand a client their own bounce and open numbers without exporting a spreadsheet by hand?
- Markup potential. Is your cost base flat enough that you can quote a fixed retainer?
- Suspension blast radius. If one client gets flagged, how many clients stop sending?
- Setup time per client. Is onboarding a 20-minute checklist or a half-day project?
The general infrastructure case is covered in SMTP server for agencies. This piece is the provider scorecard.
Scoring the six realistic options
Pricing checked against vendor pages in early 2026. Scores are mine, from running client sending on all of these.
| Provider | Client isolation | White-label | Per-client reporting | Markup potential | Blast radius | Setup per client |
|---|---|---|---|---|---|---|
| SendGrid (Pro+) | Weak, shared pool | Partial, custom domains | Good, subuser stats | Poor, per-email | Whole account | 20 min |
| Mailgun (Foundation+) | Weak without extra IPs | Good, CNAME DKIM | Good, subaccount views | Poor, per-email | Whole account | 20 min |
| Amazon SES | Good, if you build it | Good, full control | Manual, config sets | Good, $0.10/1K | Whole AWS account | 2 to 4 hrs |
| SMTP2GO | Medium, subaccounts | Partial | Good | Medium | Whole account | 15 min |
| Brevo | Weak, shared by default | Weak, vendor branding | Basic | Poor | Whole account | 15 min |
| Dedicated server, IP per client | Strong, real separation | Strong, your hostname | Per-IP and per-domain logs | Strong, flat cost | That client only | 45 min |
Two things jump out. Every hosted option has a whole-account blast radius, and only SES and a dedicated server give you a cost base flat enough to build a retainer on.
Mailgun's own pricing page confirms the tier gates: subaccounts start at Foundation ($35/month, 50K emails), and a dedicated IP is only included from Scale ($90/month, 100K emails) upward (Mailgun pricing). So the feature agencies need most sits two tiers up from where most agencies start.
Why subaccounts are not reputation isolation
This is the single most expensive misunderstanding in agency email. A subaccount separates your admin surface. It does not separate your sending reputation.
| Thing that gets separated | Subaccount | Separate IP | Separate domain |
|---|---|---|---|
| API keys and credentials | Yes | No | No |
| Stats and reporting | Yes | Partly | Yes |
| IP reputation at Gmail | No | Yes | No |
| Domain reputation at Gmail | No | No | Yes |
| Suppression lists | Usually | No | No |
| Provider suspension scope | No, parent account | No | No |
Gmail scores the sending IP and the sending domain. It has no concept of your provider's subaccount structure. So when client C uploads a two-year-old purchased list and pushes complaints to 0.6%, the IP that carried it is the same IP carrying clients A, B, D and E. Google publishes the line at 0.3% complaints for bulk senders and says senders should stay under 0.1% (Google sender guidelines). One client blowing past it drags the shared pool for everyone on it.
Real isolation is two records deep: a distinct sending IP, and a distinct sending subdomain on the client's own domain. Both, not either.
The white-label question, answered properly
White-label for an agency means two separate things and people conflate them.
- The client's dashboard experience. They log into your panel, see your logo, and never learn the vendor name.
- The mail headers. The Return-Path, the DKIM
d=domain, and the Received chain all carry the client's domain and your hostname, not a vendor's.
The second one is what actually matters for deliverability, and it is what most agencies skip. If you send for clientdomain.com but the bounce domain is bounces.sendgrid.net, SPF aligns to SendGrid, not the client. DMARC alignment then depends entirely on DKIM, and the headers publicly announce your vendor to anyone who clicks "show original".
The correct per-client setup, in the order you do it:
mail.clientdomain.com. CNAME client7.yourserver.net.
s1._domainkey.clientdomain.com. CNAME s1.dkim.yourserver.net.
clientdomain.com. TXT "v=spf1 include:spf.yourserver.net -all"
_dmarc.clientdomain.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"
The DMARC rua pointing at your agency address is the small detail that pays for itself. You get the aggregate reports, you spot the client's forgotten third-party sender before they do, and you look like you knew about it first. Full reseller mechanics are in our white-label guide and in SMTP for ESPs and reselling.
Cost for a 10-client agency at 100K each
Ten clients, 100K emails per client per month, 1M total. Nothing exotic, just steady campaign sending. Here is what each option actually bills.
| Option | Monthly cost at 1M | Dedicated IPs | Notes |
|---|---|---|---|
| Amazon SES, shared IPs | $100 | none | $0.10 per 1,000, cheapest raw rate |
| Amazon SES, 3 dedicated IPs | $175 | 3 | $24.95/IP/month on top of send cost |
| Mailgun Scale | approx $990 | 1 included | $90 base plus overage from $1.10/1K |
| SendGrid Pro tier | approx $450 to $700 | 1 to 2 add-on | Depends on contracted tier and overage |
| SMTP2GO high tier | approx $500 to $650 | add-on per IP | Subaccounts included |
| Brevo | approx $600 to $900 | add-on | Per-email tiers, tightest policy on cold traffic |
| Dedicated server, 5 to 15 IPs | $549 one-time | up to 15 | No recurring per-email cost |
The gap that matters is not month one, it is month twelve. On Mailgun Scale you have paid roughly $11,880 across the year. On a flat one-time server the number does not move. For the deeper breakdown at this volume see cost to send 1 million emails per month.
SES deserves an honest note. At $100/month for 1M emails it is genuinely the cheapest line item, confirmed on the AWS SES pricing page at $0.10 per 1,000. The catch is that everything an agency needs, you assemble: a verified identity per client domain, a configuration set per client for event tracking, an IAM user per client so credentials are revocable, and $24.95/month per dedicated IP if you want isolation. That is two to four hours per client of engineering, and a support experience that does not include a human when a client's launch is stalling.
The markup maths
Agency pricing for managed sending lands between $50 and $150 per client per month, depending on whether you also run the campaigns. Take the middle of that at $95 and run it against each cost base.
| Cost base | Cost per client/month | Bill client $95 | Gross margin |
|---|---|---|---|
| Mailgun Scale at 1M | approx $99 | $95 | negative |
| SendGrid Pro at 1M | approx $55 | $95 | 42% |
| SES with 3 dedicated IPs | approx $17.50 | $95 | 82% |
| Dedicated server, year one | approx $4.58 | $95 | 95% |
| Dedicated server, year two | approx $0 | $95 | approx 100% |
Per-email pricing does something subtle and bad to an agency: it turns your best clients into your worst margins. The client who grows from 100K to 400K sends is the one you most want to keep, and on per-email billing they cost you four times as much to serve while your retainer stays flat. Flat infrastructure inverts that. Growth is free to you and billable to them.
The other margin killer is the launch month. A client triples volume for three weeks and the overage bill lands after you have already invoiced the flat retainer. I have watched agencies eat $400 overages they could not rebill.
Suspension blast radius, the risk nobody prices in
Ask any provider's sales team what happens when one subaccount violates policy. The honest answer is that enforcement happens at the parent account, because that is where the payment method and the contract sit.
| Setup | What gets suspended | Clients still sending |
|---|---|---|
| SendGrid, 10 subusers | Parent account | 0 of 10 |
| Mailgun, 10 subaccounts | Parent account | 0 of 10 |
| SES, 10 identities, one account | Whole AWS account, sending paused | 0 of 10 |
| SES, 10 separate AWS accounts | One account | 9 of 10 |
| Own server, IP per client | Nothing, you decide | 9 of 10, you null-route the one |
That table is the argument. A hosted provider gives you a single point of failure covering your entire book of business, and the trigger is not your behaviour but your worst client's. On your own infrastructure a bad client is an operational annoyance you fix in ten minutes by pulling their credentials and parking their IP.
Recommendation by agency size
There is no single winner. There is a threshold, and it sits around five clients.
| Agency size | Recommended setup | Why |
|---|---|---|
| 1 to 4 clients | Mailgun Foundation at $35/mo, or SMTP2GO | Subaccounts are enough, isolation not yet worth the ops load |
| 5 to 15 clients | Dedicated server, IP per high-volume client | Isolation and flat cost both start paying off here |
| 15 to 40 clients | 2 to 3 servers split by client risk profile | Keep cold or aggressive senders on separate hardware |
| 40+ clients, reselling | Multi-server with per-client subdomains and IPs | You are an ESP now, price and staff accordingly |
| Very technical, cost obsessed | SES with separate AWS accounts per client | Cheapest and properly isolated, if you can afford the build |
One caveat that overrides the table: a dedicated IP needs consistent volume to hold its warmth. Below roughly 50K/month per client, that client's own IP goes cold and starts collecting deferrals. Put your small clients on a shared pool you police, and spend the IPs on the clients who send enough to keep one warm. Warm-up mechanics are in our IP warm-up schedule guide.
The last piece of advice is about firing clients. Every agency eventually has to drop one, usually the one whose list practices you have been arguing about for six months. On shared infrastructure you cannot fire them cleanly, because their damage is already spread across your pool and takes weeks to age out. On isolated IPs, the offboarding is: revoke credentials, quarantine the IP, done. Being able to say no to a bad client without it costing your other nine anything is worth more than the price difference on any of these tables.
How BulkEmailSetup helps
We build the isolated setup this article recommends. Basic is $549 one-time and includes 1 SMTP server, 3 dedicated IPs, 25,000 emails/day and unlimited contacts, with higher tiers going to 15 IPs and 200,000 emails/day. That covers a 10-client agency with dedicated IPs for your highest-volume accounts and a policed shared stream for the small ones.
Per-client SPF, DKIM, DMARC and PTR are configured on the client's own domains, so headers show their domain and your hostname, never ours. We handle warm-up and reputation monitoring per IP so onboarding a client stays a checklist rather than an engineering project. See plans on our pricing page.
Frequently asked questions
What is the best SMTP provider for an agency in 2026?
It depends on client count. Under about 5 clients, Mailgun Foundation at $35/month or SMTP2GO gives you subaccounts without much setup work. Between 5 and 20 clients, a dedicated server with per-client IPs and subdomains costs less and isolates reputation properly. Above 20 clients, most agencies run two or three servers split by client risk profile.
Do I need subaccounts or separate IPs to isolate client reputation?
Separate IPs. Subaccounts on SendGrid or Mailgun split reporting and API keys, but on a shared plan the mail still leaves from the same shared IP pool, so one client's 0.5% complaint rate still touches the others. Real isolation needs a distinct sending IP plus a distinct sending subdomain per client.
Can clients see which SMTP provider my agency uses?
They can if you do not white-label. Return-Path, the DKIM d= domain, and the Received headers all carry the provider's domain unless you set up a custom bounce domain and CNAME-based DKIM on the client's own domain. With that done, headers show the client's domain and your server hostname, never a vendor brand.
How much can an agency mark up email sending?
A common agency line is $50 to $150 per client per month for managed sending at 100K emails. On a flat $549 one-time server carrying 10 clients, your recurring cost per client is close to zero after month one, so the markup is nearly all margin. On per-email pricing at Mailgun Scale, 1M emails costs roughly $990/month, which eats about $99 per client before you bill anything.
What happens to my other clients if one gets suspended?
On SendGrid or Mailgun, a policy suspension usually hits the parent account, not the single subaccount, so all 10 clients stop sending at once. On separate SES identities the blast radius is the whole AWS account too. On your own server, a bad client costs that client's IP and nothing else, and you can null-route them in minutes.
Is Amazon SES good for agencies?
It is the cheapest at $0.10 per 1,000 emails, so 1M emails is about $100/month, but it is the most assembly. You build subaccount separation yourself with configuration sets, separate verified identities, and IAM users, and dedicated IPs cost $24.95/month each on top. Budget engineering time, not just the invoice.
Should each client get their own sending subdomain?
Yes, and it should be a subdomain of the client's domain, not yours. Send as mail.clientdomain.com so DKIM aligns to the client's own domain and their reputation builds independently. Using your agency domain for all clients merges 10 reputations into one and defeats the whole point of isolation.
